Sun Jul 7 12:58:45 2019 UTC ()
Fix some uninitialized memory access and a potential buffer overrun on
machines with multiple network interfaces.


(martin)
diff -r1.30 -r1.31 src/usr.sbin/sysinst/net.c

cvs diff -r1.30 -r1.31 src/usr.sbin/sysinst/net.c (expand / switch to unified diff)

--- src/usr.sbin/sysinst/net.c 2019/06/22 20:46:07 1.30
+++ src/usr.sbin/sysinst/net.c 2019/07/07 12:58:45 1.31
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: net.c,v 1.30 2019/06/22 20:46:07 christos Exp $ */ 1/* $NetBSD: net.c,v 1.31 2019/07/07 12:58:45 martin Exp $ */
2 2
3/* 3/*
4 * Copyright 1997 Piermont Information Systems Inc. 4 * Copyright 1997 Piermont Information Systems Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Written by Philip A. Nelson for Piermont Information Systems Inc. 7 * Written by Philip A. Nelson for Piermont Information Systems Inc.
8 * 8 *
9 * Redistribution and use in source and binary forms, with or without 9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions 10 * modification, are permitted provided that the following conditions
11 * are met: 11 * are met:
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright 14 * 2. Redistributions in binary form must reproduce the above copyright
@@ -231,28 +231,28 @@ get_ifconfig_info(struct net_desc *devs) @@ -231,28 +231,28 @@ get_ifconfig_info(struct net_desc *devs)
231 int i; 231 int i;
232 232
233 /* Get ifconfig information */ 233 /* Get ifconfig information */
234 textsize = collect(T_OUTPUT, &buf_in, "/sbin/ifconfig -l 2>/dev/null"); 234 textsize = collect(T_OUTPUT, &buf_in, "/sbin/ifconfig -l 2>/dev/null");
235 if (textsize < 0) { 235 if (textsize < 0) {
236 if (logfp) 236 if (logfp)
237 (void)fprintf(logfp, 237 (void)fprintf(logfp,
238 "Aborting: Could not run ifconfig.\n"); 238 "Aborting: Could not run ifconfig.\n");
239 (void)fprintf(stderr, "Could not run ifconfig."); 239 (void)fprintf(stderr, "Could not run ifconfig.");
240 exit(1); 240 exit(1);
241 } 241 }
242 242
243 buf = malloc (STRSIZE * sizeof(char)); 243 buf = malloc (STRSIZE * sizeof(char));
244 for (i = 0, buf_tmp = buf_in; strlen(buf_tmp) > 0 && buf_tmp < buf_in + 244 for (i = 0, buf_tmp = buf_in; i < MAX_NETS && strlen(buf_tmp) > 0
245 strlen(buf_in);) { 245 && buf_tmp < buf_in + strlen(buf_in);) {
246 tmp = stpncpy(buf, buf_tmp, strcspn(buf_tmp," \n")); 246 tmp = stpncpy(buf, buf_tmp, strcspn(buf_tmp," \n"));
247 *tmp='\0'; 247 *tmp='\0';
248 buf_tmp += (strcspn(buf_tmp, " \n") + 1) * sizeof(char); 248 buf_tmp += (strcspn(buf_tmp, " \n") + 1) * sizeof(char);
249 249
250 /* Skip ignored interfaces */ 250 /* Skip ignored interfaces */
251 for (ignore = ignored_if_names; *ignore != NULL; ignore++) { 251 for (ignore = ignored_if_names; *ignore != NULL; ignore++) {
252 size_t len = strlen(*ignore); 252 size_t len = strlen(*ignore);
253 if (strncmp(buf, *ignore, len) == 0 && 253 if (strncmp(buf, *ignore, len) == 0 &&
254 isdigit((unsigned char)buf[len])) 254 isdigit((unsigned char)buf[len]))
255 break; 255 break;
256 } 256 }
257 if (*ignore != NULL) 257 if (*ignore != NULL)
258 continue; 258 continue;
@@ -475,66 +475,75 @@ handle_license(const char *dev) @@ -475,66 +475,75 @@ handle_license(const char *dev)
475int 475int
476config_network(void) 476config_network(void)
477{ 477{
478 char *textbuf; 478 char *textbuf;
479 int octet0; 479 int octet0;
480 int dhcp_config; 480 int dhcp_config;
481 int nfs_root = 0; 481 int nfs_root = 0;
482 int slip = 0; 482 int slip = 0;
483 int pid, status; 483 int pid, status;
484 char **ap, *slcmd[10], *in_buf; 484 char **ap, *slcmd[10], *in_buf;
485 char buffer[STRSIZE]; 485 char buffer[STRSIZE];
486 struct statvfs sb; 486 struct statvfs sb;
487 struct net_desc net_devs[MAX_NETS]; 487 struct net_desc net_devs[MAX_NETS];
488 menu_ent net_menu[5]; 488 menu_ent *net_menu;
489 int menu_no; 489 int menu_no;
490 int num_devs; 490 int num_devs;
491 int selected_net; 491 int selected_net;
492 int i; 492 int i;
493#ifdef INET6 493#ifdef INET6
494 int v6config = 1, rv; 494 int v6config = 1, rv;
495#endif 495#endif
496 496
497 FILE *f; 497 FILE *f;
498 time_t now; 498 time_t now;
499 499
500 if (network_up) 500 if (network_up)
501 return (1); 501 return (1);
502 502
503 num_devs = get_ifconfig_info(net_devs); 503 num_devs = get_ifconfig_info(net_devs);
504 504
505 if (num_devs < 1) { 505 if (num_devs < 1) {
506 /* No network interfaces found! */ 506 /* No network interfaces found! */
507 hit_enter_to_continue(NULL, MSG_nonet); 507 hit_enter_to_continue(NULL, MSG_nonet);
508 return (-1); 508 return -1;
 509 }
 510
 511 net_menu = calloc(num_devs, sizeof(*net_menu));
 512 if (net_menu == NULL) {
 513 err_msg_win(err_outofmem);
 514 return -1;
509 } 515 }
510 516
511 for (i = 0; i < num_devs; i++) { 517 for (i = 0; i < num_devs; i++) {
512 net_menu[i].opt_name = net_devs[i].if_dev; 518 net_menu[i].opt_name = net_devs[i].if_dev;
513 net_menu[i].opt_flags = OPT_EXIT; 519 net_menu[i].opt_flags = OPT_EXIT;
514 net_menu[i].opt_action = set_menu_select; 520 net_menu[i].opt_action = set_menu_select;
515 } 521 }
516again: 522
517 selected_net = -1; 
518 menu_no = new_menu(MSG_netdevs, 523 menu_no = new_menu(MSG_netdevs,
519 net_menu, num_devs, -1, 4, 0, 0, 524 net_menu, num_devs, -1, 4, 0, 0,
520 MC_SCROLL, 525 MC_SCROLL,
521 NULL, NULL, NULL, NULL, NULL); 526 NULL, NULL, NULL, NULL, NULL);
 527again:
 528 selected_net = -1;
522 msg_display(MSG_asknetdev); 529 msg_display(MSG_asknetdev);
523 process_menu(menu_no, &selected_net); 530 process_menu(menu_no, &selected_net);
524 free_menu(menu_no); 531
525  532 if (selected_net == -1) {
526 if (selected_net == -1) 533 free_menu(menu_no);
527 return 0; 534 free(net_menu);
 535 return 0;
 536 }
528 537
529 network_up = 1; 538 network_up = 1;
530 dhcp_config = 0; 539 dhcp_config = 0;
531 540
532 strncpy(net_dev, net_devs[selected_net].if_dev, STRSIZE); 541 strncpy(net_dev, net_devs[selected_net].if_dev, STRSIZE);
533 542
534 if (!handle_license(net_dev)) 543 if (!handle_license(net_dev))
535 goto done; 544 goto done;
536 545
537 slip = net_dev[0] == 's' && net_dev[1] == 'l' && 546 slip = net_dev[0] == 's' && net_dev[1] == 'l' &&
538 isdigit((unsigned char)net_dev[2]); 547 isdigit((unsigned char)net_dev[2]);
539 548
540 /* If root is on NFS do not reconfigure the interface. */ 549 /* If root is on NFS do not reconfigure the interface. */
@@ -741,26 +750,29 @@ again: @@ -741,26 +750,29 @@ again:
741 net_dev, 750 net_dev,
742 *net_media == '\0' ? "<default>" : net_media, 751 *net_media == '\0' ? "<default>" : net_media,
743 *net_ip == '\0' ? "<none>" : net_ip, 752 *net_ip == '\0' ? "<none>" : net_ip,
744 *net_mask == '\0' ? "<none>" : net_mask, 753 *net_mask == '\0' ? "<none>" : net_mask,
745 *net_defroute == '\0' ? "<none>" : net_defroute); 754 *net_defroute == '\0' ? "<none>" : net_defroute);
746#ifdef INET6 755#ifdef INET6
747 msg_fmt_display_add(MSG_netokv6, "%s", 756 msg_fmt_display_add(MSG_netokv6, "%s",
748 !is_v6kernel() ? "<not supported>" : net_ip6); 757 !is_v6kernel() ? "<not supported>" : net_ip6);
749#endif 758#endif
750done: 759done:
751 if (!ask_yesno(MSG_netok_ok)) 760 if (!ask_yesno(MSG_netok_ok))
752 goto again; 761 goto again;
753 762
 763 free_menu(menu_no);
 764 free(net_menu);
 765
754 run_program(0, "/sbin/ifconfig lo0 127.0.0.1"); 766 run_program(0, "/sbin/ifconfig lo0 127.0.0.1");
755 767
756 /* dhcpcd will have configured it all for us */ 768 /* dhcpcd will have configured it all for us */
757 if (dhcp_config) { 769 if (dhcp_config) {
758 fflush(NULL); 770 fflush(NULL);
759 network_up = 1; 771 network_up = 1;
760 return network_up; 772 return network_up;
761 } 773 }
762 774
763 /* 775 /*
764 * we may want to perform checks against inconsistent configuration, 776 * we may want to perform checks against inconsistent configuration,
765 * like IPv4 DNS server without IPv4 configuration. 777 * like IPv4 DNS server without IPv4 configuration.
766 */ 778 */